libjxl: Add reference to CVE-2024-11403 and CVE-2024-11498

[Leonardo Taccari (via pkgsrc-wip) <commit-notify%pkgsrc.org@localhost>]

Module Name:	pkgsrc-wip
Committed By:	Leonardo Taccari <leot%NetBSD.org@localhost>
Pushed By:	leot
Date:		Sat Nov 30 19:37:14 2024 +0100
Changeset:	e4946645e2bc901482d45225dd241141de5ee74c

Modified Files:
	libjxl/TODO

Log Message:
libjxl: Add reference to CVE-2024-11403 and CVE-2024-11498

To see a diff of this commit:
https://wip.pkgsrc.org/cgi-bin/gitweb.cgi?p=pkgsrc-wip.git;a=commitdiff;h=e4946645e2bc901482d45225dd241141de5ee74c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

diffstat:
 libjxl/TODO | 3 +++
 1 file changed, 3 insertions(+)

diffs:
diff --git a/libjxl/TODO b/libjxl/TODO
index bb84856d17..e23b6a5c4e 100644
--- a/libjxl/TODO
+++ b/libjxl/TODO
@@ -1,3 +1,6 @@
 Don't link correctly on SunOS, missing __extendhfdf2
 The above is fixed in gcc 14. see:
 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113700
+
+This package has known vulnerabilities, please investigate and fix if possible:
+  CVE-2024-11403, CVE-2024-11498